Privacy
notice

soom.fans is run by soom tech, the data controller. Contact us about your data at contact.teetak@gmail.com.

This page says what we collect, what we use it for and what rights you have under Thailand's Personal Data Protection Act B.E. 2562 (2019). If this English version and the Thai one differ, the Thai one applies.

• Everything works without an account. If you sign in, we keep the profile from the account you use and the lists you save, and you can delete them any time.
• What you type is drawn on your own device and stored nowhere, unless you save a list, share a short link or send a list link yourself.
• We count visitors with Google Analytics only if you allow it.
• We don't sell data and don't run personalised ads.

The lists, names or questions you enter are drawn in your browser. They aren't sent to us, and aren't sent to Google Analytics.

Long share links (soom.fans/#r=…) carry the result inside the link itself and never pass through our server. Anyone with the link sees that result.

When you share a short link, we keep that result for 180 days so the link opens. Anyone with the link sees the result, but nobody can browse all links together.

If the result has other people's names, share only what's needed. If you were signed in when you shared, you can delete your own links.

Short links have a preview image made from the result. When you post the link on Facebook, LINE or another app, that app fetches the image and text and may keep a copy under its own policy, which we don't control.

Once a link expires or is deleted, its image and preview page may stay in our cache for up to 1 day.

When you send a list from My lists as a link, we keep its name, machine and items so whoever has the link can open it and draw. Anyone with the link sees the whole list, but nobody can browse all links together.

The preview when the link is posted on LINE or Facebook shows only the list's name and how many items it has, never the items.

A link lasts 1 year after anyone last opened it, then deletes itself. If you were signed in when you sent it, it's filed under your account, included in your data download and deleted with the account.

If the list has other people's names, like a class, send it only to people who should see them.

The organiser signs in and enters the group's names. The pairing happens in the database. Nobody sees all the pairs, not even the organiser, who sees only the names and who has opened.

Anyone with the group link or QR sees the group's names. When you tap your name, that phone keeps a random key, and we keep only a hash of it (it can't be turned back) next to the name. That phone can open it again, and no other phone can take the same name.

The organiser can give some names a secret code, like a birthday. We keep the code hashed too, so nobody can read it, not even the organiser, and we count wrong tries to stop guessing.

People opening their link don't sign up. They see who they're buying for and that person's wish, and can write their own wish for whoever drew them.

The organiser must have the right to use those names and should tell everyone they're using soom. A private link opens for whoever has it, so send it straight to its owner.

Everything deletes itself 60 days after the exchange day, or 120 days after creation if no day was set. The organiser can delete it any time, and it goes with the organiser's account.

When you sign in with Google, we receive the email, name, profile picture and user ID of that account. We use only the email and name, and never see your password.

Your lists may include other people's names, like a class or a team. You must have the right to use them, and add only what's needed.

Your user ID and email are never sent to Google Analytics.

The Sign in with Google button loads from Google only when you open the sign-in sheet.

• Web host (USA): serves the site to you and keeps technical access logs, and makes the short-link preview images
• Database and accounts provider (data centre in Singapore): stores accounts, saved lists, short links, list links, gift exchanges
• Google (USA): counts visitors with Google Analytics, only if you agree
• Google (USA): confirms who you are when you sign in with Google
• We don't sell data or give it to anyone for marketing.

The providers above are outside Thailand (Singapore and the USA). We choose only providers with protection to international standards, and send only what the service needs.

This site uses browser storage (localStorage) to remember your settings, which it needs to work.

Google Analytics cookies are set only when you press "Count me". Change your mind any time in the ••• menu, Privacy tab.

• See or get a copy of your data
• Get your data in a machine-readable format, or have it sent elsewhere
• Correct your data
• Have your data deleted, or its use paused
• Object to how it's used
• Withdraw consent any time, without affecting what happened before
• Complain to the Personal Data Protection Committee (PDPC) at pdpc.or.th

Send requests to contact.teetak@gmail.com. We reply within 30 days.

• Download my data (a JSON file)
• Rename or delete saved lists
• Delete my account and all its data at once

All in the account sheet: tap your name circle at the top right.

Every page uses HTTPS and we keep only what's needed. If a breach puts you at risk, we tell the PDPC within 72 hours and you as soon as we can.

If we change how we use data, we'll update this page and the date below. Last updated 3 October 2026.